CVE-2026-18244
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
GitLab has remediated an issue in GitLab EE affecting all versions from 17.7 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to view restricted configuration settings due to improper authorization checks on a group settings page.
Risk Assessment
The risk is unauthorized access to sensitive configuration settings, which could expose group configuration information and potentially enable further attacks.
Recommendation
It is recommended to upgrade GitLab to version 19.0.6, 19.1.4, or 19.2.2 as soon as possible to eliminate the vulnerability.
Original NVD description (English source)
GitLab has remediated an issue in GitLab EE affecting all versions from 17.7 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to view restricted configuration settings due to improper authorization checks on a group settings page.